Oh, I managed to figure out how to debug the crash dump (gdb -k
kernfile corefile). Here's the results, if anyone's interested:

(kgdb) bt
#0  0xfffffc000044eb20 in dumpsys ()
    at ../../../../arch/alpha/alpha/machdep.c:924
#1  0xfffffc000044e8cc in cpu_reboot ()
    at ../../../../arch/alpha/alpha/machdep.c:789
#2  0xfffffc0000344534 in panic () at ../../../../kern/subr_prf.c:149
#3  0xfffffc0000451804 in pmap_enter ()
    at ../../../../arch/alpha/alpha/pmap.old.c:1174
#4  0xfffffc0000405740 in vm_fault () at ../../../../vm/vm_fault.c:826
#5  0xfffffc0000454f84 in trap () at ../../../../arch/alpha/alpha/trap.c:342
(kgdb) frame 5
#5  0xfffffc0000454f84 in trap () at ../../../../arch/alpha/alpha/trap.c:342
342                             rv = vm_fault(map, va, ftype, FALSE);
(kgdb) l
337             
338                             va = trunc_page((vm_offset_t)a0);
339     #ifdef NEW_PMAP
340                             printf("mmfault going to vm_fault\n");
341     #endif
342                             rv = vm_fault(map, va, ftype, FALSE);
343     #ifdef NEW_PMAP
344                             printf("mmfault back from vm_fault\n");
345     #endif
346                             /*
(kgdb) frame 4
#4  0xfffffc0000405740 in vm_fault () at ../../../../vm/vm_fault.c:826
826             pmap_enter(map->pmap, vaddr, VM_PAGE_TO_PHYS(m), prot, wired);
(kgdb) l
821              *      may cause other faults.   We don't put the
822              *      page back on the active queue until later so
823              *      that the page-out daemon won't find us (yet).
824              */
825     
826             pmap_enter(map->pmap, vaddr, VM_PAGE_TO_PHYS(m), prot, wired);
827     
828             /*
829              *      If the page is not wired down, then put it where the
830              *      pageout daemon can find it.
(kgdb) frame 3
#3  0xfffffc0000451804 in pmap_enter ()
    at ../../../../arch/alpha/alpha/pmap.old.c:1174
1174                                            panic("pmap_enter: already in pv_tab");
(kgdb) l
1169                     */
1170                    else {
1171    #ifdef DEBUG
1172                            for (npv = pv; npv; npv = npv->pv_next)
1173                                    if (pmap == npv->pv_pmap && va == npv->pv_va)
1174                                            panic("pmap_enter: already in pv_tab");
1175    #endif
1176                            npv = pmap_alloc_pv();
1177                            npv->pv_va = va;
1178                            npv->pv_pmap = pmap;

cjs

Curt Sampson    cjs@portal.ca		Info at http://www.portal.ca/
Internet Portal Services, Inc.		`And malt does more than Milton can
Vancouver, BC   (604) 257-9400		 To justify God's ways to man.'